Affected Systems

Orkes Conductor workflow platform versions 3.21.21 through 3.30.1. All deployments with externally accessible workflow API endpoints and unsandboxed GraalVM evaluators configured with unrestricted host access are vulnerable.

Exploitation Status

Active exploitation confirmed. Fortinet blocked 1,290 attacks in 24 hours (September 9, 2026), with nearly 7,000 attempts between September 2-9. Previdian honeypots detected exploitation attempts since July 24, 2026. Empirical Security confirmed exploitation as of August 21, 2026. Attack sources primarily from Germany, Hong Kong, Indonesia, UAE, and India.

Business Impact

Unauthenticated remote attackers can execute arbitrary OS commands with Conductor process privileges by submitting malicious workflow definitions containing JavaScript or Python expressions to the workflow API. Exploitation requires no authentication and leverages unsandboxed GraalVM evaluators to escape scripting environment via Java reflection or direct subprocess calls through INLINE, LAMBDA, DO_WHILE, and SWITCH task types. CVSS 9.8 (v3.1) / 9.3 (v4.0). Rapid exploitation increase (132% daily growth) indicates widespread scanning and targeting.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade Orkes Conductor to version 3.30.2 or later immediately to remediate CVE-2026-58138
  • If patching is not immediately possible, restrict external network access to Conductor workflow API endpoints using firewall rules or network segmentation
  • Place Conductor instances behind VPN, reverse proxy with authentication, or other network access controls to prevent unauthenticated access
  • Monitor Conductor logs for suspicious workflow submissions, particularly those containing JavaScript or Python expressions in INLINE, LAMBDA, DO_WHILE, or SWITCH task types
  • Review system logs for unexpected command execution or subprocess activity originating from Conductor processes, especially connections from Germany, Hong Kong, Indonesia, UAE, and India